Embed Size (px)
Citation preview
© WAVESTONE 2
What people think of when I talk about mainframes
© WAVESTONE 3
The reality: IBM zEC 13 technical specs:
• 10 TB of RAM
• 141 processors,5 GHz
• Dedicated processors for JAVA, XML and
UNIX
• Cryptographic chips…
Badass Badass Badass !!
So what…who uses those anymore ?
© WAVESTONE 4
APIS IT - Atos Origin - Applabs - Arby’s – Wendy’s Group - Archer Daniels Midland - Assurant - AT&T / BellSouth / Cingular - Atlanta Housing Authority - Atlanta Journal Constitution - Atlantic Pacific Tea Company (A&P) - Aurum/BSPR - Auto Zone - Aviva - Avnet - Avon (Westchester) - Axa (Jersey City) - ANZ Bank - BI Moyle Associates, Inc. - Bajaj Allianz - Bank Central Asia (BCA) - Bank Indonesia (BI) - Bank International Indonesia (BII) - Bank Nasional Indonesia (BNI46) - Bank Of America - Bank of America (BAC) - Bank of America (was Nations Bank – Can work out of Alpharetta office) - Bank of Montreal (BMO:CN) - Bank of New York Mellon (BNY) (BK) New York NY, Pittsburgh, PA and Nashville, TN, Everett - Bank of Tokyo (Jersey City) - Bank Rakyat Indonesia (BRI) - Bank Vontobel - BB&T - Belastingdienst - Bi-Lo - Blue Cross Blue Shield - Blue Cross Blue Shield GA - Blue Cross Blue Shield MD - Blue Cross Blue Shield SC - Blue Cross Blue Shield TN - Blue Cross/Blue Shield of Texas - Brindley Technologies - BMC Software - BMW - BNP Paribas Fortis Brussels Belgium - BNP Paribas Paris France - Boston Univerity - Broadridge Financial Services - Brotherhood Bank & Trust - Broward County Schools - Brown Brothers Harriman (BBH) - British Airways - C&S Wholesale Grocers - CA Technologies - California Casualty Management Company, San Mateo and Sacramento, CA - Canadian Imperial Bank of Commerce (CIBC) - CAP GEMINI - Capco - Capital One - Glen Allen/West Creek - Catapiller - Cathy Pacific - CDSI - Ceridian - CGI - Charles Schwab - Chase - Chemical Abstract Services (CAS) - Choice Point - Chrysler - Chubb - Ciber - CIC - CIGNA - Citi - Citi / Primerica - Citigroup - City and County of Alameda, California - City of Atlanta - City of New York (Several locations) - City of Phoenix Phoenix Az USA David DeBevec - Co-operators Canada - Coca Cola Enterprises - Coca-Cola Co - Coding Basics, Inc. - Cognizant Technology Solutions - Collective Brands - Collabera - Commonwealth Automobile Reinsurers - Comerica Bank - Commerce Bank Kansas City MO USA - Commerzbank - Community Loans of America - Computer Outsourcing - Computer Sciences Corporation (CSC) - Con Edison (Manhattan) - Connecticut, State of (various Departments including Transportation, Public Safety, and Information Technologies) - Connecture - Conseco - Cotton States Mutual Ins Company - COVANYS - CPS - CPU Service - Crawford and Company - Credit Suisse - CSC - CSI International OH USA Jon Henderson, COO - CSX - CTS - Customs & Border Enforcement (CBE) - CVS pharmacy - DATEV eG - Dekalb County - Delphi - Delta Air Lines Inc - Depository Trust and Clearing Corp - Deutsche Bank - Deutsche Bundesbank - DHL IT Services - Delloits - DEVK Köln - DIGITAL - Dominion Power/Dominion Resources - Glen Allen/Innsbrook - Donovan Data Systems (Manhattan) - DST - DST Output - DTC (Manhattan) - Duke Energy - Duke Power, DB2 apps - Eaton Cleveland Ohio USA Cooper MA - Ecolab, Inc - EDB ErgoGroup - Eddie Bauer - EDEKA - EDS - Edward Jones St. Louis MO Tempe AZ USA - ELCOT - ELIT - Emblem Health - EMC - Emigrant Savings Bank - Emirates Airline - Emory Univ - Enbridge Gas Distribution - Energy Future Holdings Dallas Tx USA - Equifax Inc - Experian Americas - Express Scripts - Extensity - Family Life Ins. Co. - FannieMae - Farm Bureau Financial Services - Federal Reserve - FedEx - FHNC/First Tennessee Bank - Fidelity Investments Boston MA & New York - Fiducia - FINA - Finanz Informatik - First Data - FIS - Fiserv (formerly Check Free) - Fiserv IntegraSys - Florida Blue - Florida Power & Light - Florida Power & Light (FPL) Juno Beach FL USA Utility - Ford - Ford Motor Co - Fortis - FPL - Franklin Templeton - FreddieMac - Friedkin Information Technology Houston TX USA - Fujitsu America Dallas TX KLCameron Outsourcing - Fulton County - Garanti Technology Istanbul Turkey - GAVI - Garuda Indonesia Jakarta Indonesia Gun gun - GCCPC - GE Financial Assurance - GEICO Atlanta GA Insurance - General Dynamics - General Motors Detroit Austin Atlanta Phoenix - Genuine Auto Parts ( Motion Industries) - Georgia Farm Bureau Mutual - Georgia Pacific - Georgia State Dept of Education - GEORGIA STATE UNIVERSITY - GKVI - Global SMS Networks Pvt. Ltd. ( GLOBALSMSC ) - GM - GMAC SmartCash - Grady Hospital - Great-West Life - Governor's Office - Great Lakes Higher Education Corp. - Group Health Cooperative - Guardian Life - Gwinnett County - Gwinnett County School District - Gwinnett Medical Center - H. E. Butt Grocery Co. - H&W Computer Systems, Inc. - Harland Clarke (John H. Harland Co) - Hartford Life - HCL - HDFC Bank - HealthPlan Services - Heartland Payment Systems (Texas) - Helsana - Hewlett Packard - Hewlett-Packard - Hexaware - Highmark - HMC Holdings (Manhattan) - HMS - Home Depot U.S.A., Inc. - HPS4 - HSBC Trinkaus & Burkhardt AG - HSBC - IBM - IBM Global Services - IBM India - IBM Silicon Valley Laboratory, San Jose, CA (home of DFSMS, DB2, IMS, languages) - IBM Tucson, Arizona Software Development Laboratory (DFSMShsm, Copy Services) - Iflex - Igate Hyderabad India Sivaprasad Vura - Information Builders - Infosys - Infotel - ING - ING NA Insurance Corp - Innova Solutions Inc. - Insurance Services Office - Intercontinental Hotels Group - IPACS - IRS - IRS, New Carrolton MD - ISO (Jersey City) - ITERGO - IVV - Jackson National - Jefferies Bank - John Dere - JPMorgan Chase - Kaiser Permanente Corona CA USA - Kansas City Life - Kawasaki Motors Corp - KEANE - KEONICS - Key Bank - Klein Mgt. Systems (Westchester) - Kohls Department Stores - Krakatau Steel Cilegon Indonesia - KPN - Krasdale Foods, Inc. - L&T - LabCorp - Lawrence Livermore National Laboratories, Livermore, CA - LBBW (Landesbank Baden Wuerttemberg) - LDS - Lender Processing Services (LPS) - Leumi Bank Leumi Bank Tel-Aviv ISrael, Shai Perry - Lexis Nexis (formerly ChoicePoint Inc) - Liberty Life - Liberty Mutual (Safeco Insurance) - Lincoln National - Lloyds Banking Group - Lockheed - logica CMG - Logica Inc - Lousiana Housing Fin Ag / Baton Rouge CC - Lowe's - Lufthansa Systems - M&T Bank - Macro Soft - Macy's Systems and Technologies - Maersk Data (Global Logistics/Shipment Tracking)
© WAVESTONE 5
Maersk Lines (Global Container Shipping), - Mahindra Satyam - Mainframe Co Ltd - Mainline Information Systems - Maintec Technologies Inc. - MAJORIS - Manhattan Associates - Manulife - Marist College - Marriott Hotel - MARTA - MASCON - Mass Mutual - MASTEK - Master Card INC - May bank - MBT - Media Ocean (office here, HQ most likely New York) - Medical College of Georgia - Medical Mutual of Ohio Cleveland OH USA CooperMA - Medicare - Medstar Health - Meredith Corp - Merlin International - Veteran Affairs - Merrill Lynch (now BOA) - MetaVante (Now Fidelity) - Metlife - Metro North (Manhattan) - MFX Fairfax Morristown NJ USA KLCameron Outsourcing - MHS - Miami Dade County - MINDTEK - MINDTREE - Ministry of Interior (NIC) - Missouri Gas Energy Kansas City MO USA KLCameron Utility - Modern Woodmen of America - Montefiore Hospital (Bronx) - Morgan Stanley (Brooklyn) - Motor Vehicles Admin - Mphasis - Mpowerss - Mt. Sinai (Bronx) - Mutual of America - NASDAQ Stock Market - Nation Wide Insurance - National Life Group - National Life Ins. Co. - NAV - Navistar - NBNZ - Nest - New York Times (Manhattan) - New York University - Nike INC - Norfolk Southern Corp - Norfork Southern Railway - North Carolina State Employees' Credit Union -NYS Dept of Tax and Fin - OCIT , Sacramento Cty - OFD - Office Depot Deerfield & DelRay - Outsourcing deTecnica deSistemas - Hardware - Old Mutual - Ohio Public Employees Retirement System - ONCOR Dallas TX USA - Paccar - Palm Beach County School DistrictThe School District of Palm Beach County West Palm Beach FL USA George Rodriguez - Parker Hannifin Cleveland Ohio USA Cooperma - Partsearch Technologies - Patni - Penn Mutual - Pepsico INC - Pershing LLC - Philip Morris - Phoenix Companies - Phoenix Home Life - Physicians Mutual Insurance Company (PMIC) Omaha NE USA KLCameron Insurance - Pioneer Life Insurance - Pitney Bowes (Danbury, Ct.) - PKO BP Warszawa, Poland - PNC Bank Pittsburgh PA USA - POLARIS - Polfa Tarchomin - Praxair (Danbury, Ct.) - Primerica Life Ins Co - Princeton Retirement Group Inc - Principal Financial Group - Progressive Insurance - Prokarma Hyderabad India Sivaprasad Vura - Protech Training - Prudential - PSA Peugeot Citroen - PSP - PSC Electrical Contracting - Publix - Puget Sound Energy (Seattle) - PCCW - PWC - QBE the Americas - R R Donlley - R+V - RBS (Royal Bank of Scotland) - RBSLynk - RHB bank - Rite Aid - Riyad Bank - Rocket Software - Roundy's Supermarkets Milwaukee WI USA - Royal Bank of Canada (RBC) - Rubbermaid - Russell Stovers - Rutgers University - Office of IT - Ryder Trucks Miami FL USA - S1 - SAS - SAS Institute NC USA - SATHYAM/PCS - SCHLUMBERGER Sema - Schneider National Green Bay WI USA KLCameron Transportation - Scientific Games International, Inc - Scope International(Standard Chatered) - Scotiabank - Scott Trade - SE Tools - Seminole Electric - Sentry Insurance - Sears Holdings Corporation - Self Employed Consultant - Shands HealthCare - SIAC (Brooklyn) - Siemens - SLK software - Sloan Kettering (Bronx) - Social Security - Software Paradigms India - Southern California Edison - Southern Company - Standard Insurance - State Auto Insurance - State Farm Ins - State of Alabama Child Support Enforcement Services - State of Alaska - State of California Teale Data Center, Rancho Cordova, CA - State of Connecticut (various Departments including Public Safety, Transportation, Information Technologies) - State of Florida - Northwest Regional Data Center - State of GA - DHS - State of GA - DOL - State of GA - GTA - State of Georgia - State of Illinois - Central Management Services (CMS) - Springfield, IL - State of Montana - Statens Uddannelsesstøtte - Steria - SunGard - SunGard Computer Services Voorhees NJ - Suntrust Banks Inc - Symetra - SYNTEL - TAG - Taiwan Cooperative Bank Taiwan - Tampa General - Target INC - Target India - Tata Steel - TCS - TD Ameritrade - TD Auto Finance - TD Canada Trust - TechData - TECO - TESCO Bangalore India Sivaprasad Vura - Texas A&M University Colleg Station TX USA - Thomson Financial-Transaction Services - Thomson Reuters - Thrivent - TIAA-CREF - Time Customer Service - TIMKEN - Total Systems - Traveler's Insurance - Travelport - Treehouse Software, Inc. - Trinity Health - TUI - Turner Broadcasting TBS - T. Rowe Price - T-Systems - UBS - UBS APAC (Union Bank of Switzerland) - Union Bank - Union Pacific Omaha NE USA KLCameron Transportation - United Health Care (UHG) - United Health Group (UHG) - United Missouri Bank - United Parcel Service Inc (UPS) - United Parcel Service Inc - United States Postal Service - United States Postal Service - DB2 DBA Ops - United States Postal Service — Mainframe Ops - United States Postal Service — Mgmt Ops - United States Postal Service Applic. Dev. - United States Steel - United Technologies - Universität Leipzig - University of California at Berkeley, CA - University of Chicago Chicago IL USA - University of NC - University System of Georgia - UNUM Disability/Insurance Portland ME Columbia SC - UPS (Paramus, NJ) - US Bank - US Software - USAA - Utica Insurance Utica NY USA Insurance - Vanguard Group - Verizon (Wireless) - Vertex (only Seattle area) - VETTRI - VF Corp. - Virginia Department of Motor Vehicles - Virginia Dept of Corrections - Virginia State Corp, Commission - VISA Inc. - VOLVO IT Corp. - VW - Wachovia (merging into Wells Fargo) - Waddell & Reed FInancial Services - Wakefern Food Corp - Walmart - Washington State Department of Social and Health Services - Washington State Department of Transportation - Washington State Employment Security Department - Watkins(now part of Fedex) - Wellogic - Wellmark - Wellpoint - Wells Fargo Bank various USA locations including NY, NJ, NC - WGV - Winn-Dixie - WIPRO - WIPRO Technologies - WIPRO (ex-InfoCrossing) USA Outsourcing - XANSA - Xerox - YRCW - Zions Bancorporation - Banco Davivienda - Blue Cross Blue Shield AL - State of Alabama - ZETO - Avon Brasil - Bacen www.bcb.gov.br - Banco do Brasil - Banco Bradesco - Banco Itau - Bic Banco - Bovespa - Casas Bahia - CEF - CEPROMAT - Cielo - Copel - Consist - CPQD - DPF - Fiat - IGS - HSBC GLT - Matera - Montreal - Porto Seguro - Prodam SP - ProdeSP - RedeCard - Riocard TI - Sanepar - Santander - Serasa Experian - SERPRO - Tivit - T-System - Voith - Zagrebacka Banka (ZABA) - NMBS-Holding - City of Tulsa - State of AZ - ADOT - Business Connexion (www.bcx.co.za) - Strate (www.Strate.co.za) - First National Bank - Reserve Bank of India (www.rbi.org.in) - Allied Irish Bank AIB (www.aib.ie) - Sainsburys Plc - GAP Inc - Barclays bank - ABSA Bank
© WAVESTONE 6 https://mainframesproject.tumblr.com
© WAVESTONE 7 https://mainframesproject.tumblr.com
© WAVESTONE 8
About me
Pentester at Wavestone, mainly hacking Windows and Unix stuff
First got my hands on a mainframe in 2014…Hooked ever since
When not hacking stuff: Metal and wine
• zospentest.tumblr.com
• github.com/ayoul3
• Ayoul3__
© WAVESTONE 9
This talk
Demystifying mainframes
Basics of z/OS
Customer Information Control System (CICS)
Hacking CICS
@ayoul3__
© WAVESTONE 10
Quick intro to mainframe Z
Main OS on IBM Z Series is called z/OS (v1.14 and v2.2) Need a 3270 emulator (x3270, wc3270) to interact remotely with a Mainframe TN3270 is heavily based on telnet and is supported by Wireshark
@ayoul3__
© WAVESTONE 11
What we need to know about z/OS
VTAM: Virtual Telecommunication Access Method TSO: Time Sharing option JES: JOB Entry System OMVS: Open MVS RACF: Resource Access Control Facility
@ayoul3__
© WAVESTONE 12
VTAM is the software driver that handles TCPIP sessions (and SNA) Most likely the first thing you see when connecting to the mainframe Runs on port 23, 992, 5023, etc. Gives access to most applications hosted on the Mainframe Each application has a max-8 character identifier TIP: if you want to know if you’ re on VTAM type: IBM ECHO. It should return 123456789ABCDEFGH…
VTAM Virtual Telecommunication Access Method
© WAVESTONE 13
© WAVESTONE 14
TSO is the the equivalent of a shell on z/OS Used to execute commands, browse files, etc.
TSO Time sharing option
@ayoul3__
© WAVESTONE 15
© WAVESTONE 16
Every program on z/OS is run as a JOB JCL is the ‘scripting’ language used to write a JOB on Mainframe JOBs are queued in JES which decides which one to run depending on the JOB’s priority
JES JOB Entry System
@ayoul3__
© WAVESTONE 17
JOB CARD
PROGRAM
INPUTS
© WAVESTONE 18
Unix System Services
USS
@ayoul3__
© WAVESTONE 19
USS stands for Unix System services Every z/OS has a UNIX running on it (since 2001) It implements TCP/IP stack, handles HTTP, FTP, JAVA… Can be accessed directly via open telnet port (1023) or with OMVS command from TSO
USS
@ayoul3__
© WAVESTONE 20
© WAVESTONE 21
RACF Resource Access Control Facility
RACF is the core security system on z/OS It is the database that holds all secrets (passwords, certificates, cipher keys, etc.) Controls every resource access, privilege escalation, execution, authentication RACF is a product of IBM. Other security systems like TopSecret or ACF2 may be used instead of RACF
@ayoul3__
© WAVESTONE 22
Ok then, pentest this…
© WAVESTONE 23
And then there was CICS…
Customer Information Control System
CICS is a combination Wordpress and Apache…before it was cool (around 1968) Current version is CICS TS 5.3
@ayoul3__
© WAVESTONE 24
API in COBOL/C/Java Handles cache, concurrence access, etc. Uniform rendering of the screen Easily thousands of request/sec
© WAVESTONE 25
Order the following by requests/second
Google search
Facebook like
Youtube views
Twitter tweet
CICS
@ayoul3__
© WAVESTONE 26
0.00
200,000.00
400,000.00
600,000.00
800,000.00
1,000,000.00
1,200,000.00
1,400,000.00
Youtube views Facebookposts
Google search Twitter tweets CICS
Requests per second around the world
@ayoul3__
© WAVESTONE 27
© WAVESTONE 28
© WAVESTONE 29
© WAVESTONE 30
CICS flow
VTAM CUST1
CICS region (CUST1)
GMTRAN = CESN INQ1
RACF
TRAN ID PROGRAM
CESN DFHSNP
INQ1 CUSTINQ1
PCT
PROGRAM LOCATION
DFHCOMP2 DFH320.SDFHLOAD
(DFHSNP)
CUSTINQ1 DFH320.SDFHLOAD
(CUSTINQ1)
PPT
User & Password
OK
@ayoul3__
© WAVESTONE 31
CICS flow
VTAM CUST1
CUST1
GMTRAN = CESN INQ1
FCT
FILE LOCATION LOAD
CUSTMAS AYOUB.KICKS.MURACH.CUSTMAS 0
EXEC CICS READ FILE(CUSTMAS) END-EXEC
DISK
@ayoul3__
© WAVESTONE 32
Now that we are CICS experts Let’s break this ****
@ayoul3__
© WAVESTONE 33
Jail break
Find the right combination of keys to interrupt the normal flow of an App and get back to the CICS terminal
It is the equivalent of finding the admin panel on a URL…except way easier
It can be to press PF3 on the logon panel, or RESET button, or PF12 on some menu, etc.
@ayoul3__
© WAVESTONE 34
1. Escaping from the CICS app
© WAVESTONE 35
1. Escaping from the CICS app
© WAVESTONE 36
We can enter any transaction ID..now what ?
The ID is 4 digits….we can easily bruteforce it : • Mainframe_brute:
https://github.com/sensepost/mainframe_brute
• Nmap scripts: https://github.com/zedsec390/NMAP/blob/master/cics-enum.nse
• CICSShot: https://github.com/ayoul3/cicsshot
@ayoul3__
© WAVESTONE 37
CESN (Login transaction)
CEMT (Master terminal console)
CECI (Live interpreter debugger)
CEDA (Online Resource Definition program)
CEDB (Offline Resource Definition program)
Default transactions
@ayoul3__
© WAVESTONE 38
CEMT
© WAVESTONE 39
CEMT INQUIRE
© WAVESTONE 40
© WAVESTONE 41
© WAVESTONE 42
© WAVESTONE 43
© WAVESTONE 44
HLQ REST
File Options
© WAVESTONE 45
© WAVESTONE 46
© WAVESTONE 47
CEMT
Get some useful information about the system: • List temporary storage queues • List DB2 connections • List webservices • Scrap userids in menus
Uninstall programs, files, webservices, db2connections,etc.
@ayoul3__
© WAVESTONE 48
CECI
It executes CICS API commands…that’s it really :-)
© WAVESTONE 49
Remember the CICS APIs
© WAVESTONE 50
CECI
© WAVESTONE 51
CECI
© WAVESTONE 52
CECI
© WAVESTONE 53
CECI
© WAVESTONE 54
CECI
© WAVESTONE 55
© WAVESTONE 56
This is all nice but can we 0wn the mainframe ?
@ayoul3__
© WAVESTONE 57
CICS has a nice feature called Spool functions
A spool is basically a normal dataset (or file) containing the output of a JOB (program)
Using Spool functions we can generate a dataset and send it directly to JES (Job scheduler)…which will execute it !
CECI
@ayoul3__
© WAVESTONE 58
The theory
@ayoul3__
© WAVESTONE 59
The theory
@ayoul3__
© WAVESTONE 60
The theory
@ayoul3__
© WAVESTONE 61
© WAVESTONE 62
© WAVESTONE 63
© WAVESTONE 64
© WAVESTONE 65
Hurray ! @ayoul3__
© WAVESTONE 66
Let’s automate this to do some 3l33t3 stuff @ayoul3__
© WAVESTONE 67
A nice reverse shell
Allocation of a dataset
Reverse shell in REXX
Execution of the dataset
© WAVESTONE 68
© WAVESTONE 69
Kicker #1
Shell payloads included in CICSPwn:
• reverse_tso/direct_tso: shell in the TSO environment
• reverse_unix/direct_unix: shell in the UNIX environment
• ftp: connects to an FTP server and pushes/gets files
• reverse_rexx/direct_rexx: execute rexx script directly in memory
• Custom JCL: executes your own JCL @ayoul3__
© WAVESTONE 70
The JOB is executed with the userid launching CICS (START2) regardless of the user submitting it
Kicker #2
© WAVESTONE 71
Kicker #2
© WAVESTONE 72
What if it were NODE(WASHDC) or NODE(REMOTESYS) …
Yes execution on another mainframe :-)
Kicker #3
© WAVESTONE 73
A few problems though…
• Spool option turned off (Spool=NO)
• CECI not available
@ayoul3__
© WAVESTONE 74
© WAVESTONE 75
Use Transient Data Queues instead TDQ are handles towards files not defined in CICS Some files are more special than others
Spool=NO
@ayoul3__
© WAVESTONE 76
TDQueues
© WAVESTONE 77
TDQueues
© WAVESTONE 78
• Spool option turned off (Spool=NO)
• CECI not available
One down
@ayoul3__
© WAVESTONE 79
CECI not available
© WAVESTONE 80
To forbid CECI for instance RACF admins define the following rule:
RDEFINE TCICSTRN CECI UACC(NONE)
CECI RACF rule
@ayoul3__
© WAVESTONE 81
CEDA is an IBM utility to manage resources on CICS • map files to their real locations • set temporary storage files • define/alter resources
CEDA to the rescue
It is way less protected than CECI
The idea is to copy CECI to a new transaction name always made available by RACF : Logon transaction Printing transaction Paging transaction…
@ayoul3__
© WAVESTONE 82
CEDA to the rescue
© WAVESTONE 83
If you have access to CEDA you can bypass any RACF rule Use --bypass on CICSPwn ;)
CEDA to the rescue
@ayoul3__
© WAVESTONE 84
vv
CEDA to the rescue
© WAVESTONE 85
CEDA to the rescue
© WAVESTONE 86
• zospentest.tumblr.com
• github.com/ayoul3
• Ayoul3__
